Spring Security question. Annotation does not work when RequestMap is stored in DB (Doc section 4.6). For example this won’t work

@Secured("hasRole('ROLE_ADMIN')")
    def index(Integer max) {

But it works if we use Static RequestMap (Doc section 4.5). Is this a correct behaviour?

Yes, when using RequestMap all URLMappings are stored in the DB + you can optionally add staticRules in application.yml/groovy. The last time I used it, we pushed all the rules to the DB, so they only lived in one location. The downside of RequestMap, is the authorization is based on rules in the DB vs code and so the migrations executed need to match exactly the code you are attempting to run and it gets a little tricky when you need to go back in time in git.

For example. I want Teacher to be managed in DB RequestMap and Cars to be managed by annotation _@Secured(“hasRole(‘ROLE_ADMIN’)“)_. It doesn’t work. If i use DB then all statically declared in application.groovy and all annotations stop working.

It's not meant to mix and match. With requestmaps the only way you can declare non DB rules would be:

grails.plugin.springsecurity.controllerAnnotations.staticRules = [

[pattern: '/',               access: ['permitAll']],

[pattern: '/error',          access: ['permitAll']],

[pattern: '/index',          access: ['permitAll']],

[pattern: '/index.gsp',      access: ['permitAll']],

[pattern: '/shutdown',       access: ['permitAll']],

[pattern: '/assets/**',      access: ['permitAll']],

[pattern: '/**/js/**',       access: ['permitAll']],

[pattern: '/**/css/**',      access: ['permitAll']],

[pattern: '/**/images/**',   access: ['permitAll']],

[pattern: '/**/favicon.ico', access: ['permitAll']]

]

grails:

plugin:

springsecurity:

controllerAnnotations:

staticRules:

- pattern: "/"

access:

- permitAll

- pattern: "/error"

access:

- permitAll

- pattern: "/index"

access:

- permitAll

- pattern: "/index.gsp"

access:

- permitAll

- pattern: "/shutdown"

access:

- permitAll

- pattern: "/assets/**"

access:

- permitAll

- pattern: "/**/js/**"

access:

- permitAll

- pattern: "/**/css/**"

access:

- permitAll

- pattern: "/**/images/**"

access:

- permitAll

- pattern: "/**/favicon.ico"

access:

- permitAll

Hah i see now where doc confused me. You are right. Thanks.